                   (:session-store this)
                   (-> req cookies-request :cookies (get "session-id") :value))]
           ;; TODO Obey the 'prompt' value in OpenID/Connect
-          {:status 200 :body (str "Hi - it appears you're already logged in, session is " (pr-str session))}
-
+          (do
+            (infof "Hi - it appears you're already logged in, session is %s" (pr-str session))
+            {:status 302
+             :headers {"Location" (path-for (:modular.bidi/routes req) ::get-authenticate-form)}})
           (let [session (create-session!
                          (:session-store this)
                          {:client-id (-> req :query-params (get "client_id"))
                           :scope (-> req :query-params (get "scope"))
                           :state (-> req :query-params (get "state"))
                           })]
+            (infof "Hi - it appears you're not already logged in, so I'm going to create a session for you and redirect you")
             (cookies-response
-             {:status 200
-              :body "Hi - it appears you're not already logged in, so I'm going to create a session for you and redirect you"
-              :cookies {"session-id" (->cookie session)}}))))
+                      {:status 302
+                       :headers {"Location" (path-for (:modular.bidi/routes req) ::get-authenticate-form)}
+                       :cookies {"session-id" (->cookie session)}}))))
          wrap-params)
 
      ::get-authenticate-form

           (let [params (-> req :form-params)
                 identity (get params "user")
                 password (get params "password")
                 client-id (get params "client_id")
                 scope (get params "scope")
                 state (get params "state")
                 scopes (set (str/split scope #"[\s]+"))
                 ;; Lookup application
                 {:keys [callback-uri] :as application}

                            {:created (java.util.Date.)
                             :cylon/identity identity})

                     (cookies-response {:status 302
                       :headers {"Location"
                                 (format
                                  ;; TODO: Replace this with the callback uri
                                  "%s?code=%s&state=%s"
                                  callback-uri code state
                                  )}
                       :cookies {"session-id" (->cookie session)}}))))
               ;; Fail
               {:status 302
                :headers {"Location" (format "%s" (path-for (:modular.bidi/routes req) ::get-authenticate-form))}
                :body "Try again"})))

         wrap-params wrap-cookies s/with-fn-validation)
